cardsmobile-notifications@35.7.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

require("cardsmobile-notifications") or any import resolving index.js

Arbitrary attacker-controlled code executes under the importing process user.

import-time remote binary download, drop, chmod, and detached execution

The main entry point suppresses errors while requiring _support.js. That module runs immediately unless telemetry opt-out variables are set, fetches a platform-specific payload from obfuscated remote hosts or DNS TXT records, writes it to a temporary path, makes non-Windows files executable, and launches it detached through a shell or cmd.exe. The payload is neither authenticated nor validated beyond size.

This is a concrete import-time remote code execution chain, not package-aligned telemetry. The dormant-looking telemetry module contains the same downloader/launcher pattern, reinforcing intent.